Future Proof – Protecting our digital future

photo credit: gemma maree

We have been receiving a lot of enquiries about how to configure SharePoint so that it can serve business and recordkeeping purposes.

We hope to issue more comprehensive guidance about this in the new year, but in the interim, we want to provide some initial advice for all of those we know are grappling with SharePoint configuration.

Some quick summary points:

• SharePoint 2010 can be configured to have good recordkeeping capacities
• BUT it will take a significant investment of time, money and strategy to achieve this
• Therefore, while licence costs for SharePoint may be relatively inexpensive, do not overlook the costs of configuration and implementation which could be considerable
• That said, with the appropriate investment and configuration, SharePoint can be an effective recordkeeping tool that operates as an easy to use business system for the user and makes many records managment obligations and operations invisible
• Be aware though that the recordkeeping capacities in SharePoint 2007 are much more limited and the following advice all applies to SharePoint 2010.

This initial advice has been compiled using the various references cited below and through preliminary discussions with a range of Government bodies in NSW.  We do however regard this advice as our initial, draft views on recordkeeping and SharePoint.

In the New Year we hope to sit down with a range of Government agencies who are implementing SharePoint and discuss the specific decisions and choices they’ve made and use this to further develop and refine our advice. But the steady stream of enquiries we are getting shows that NSW government bodies need an initial overview of the recordkeeping issues and considerations associated with a SharePoint 2010 implementation now.

Until we can develop more comprehensive guidance we would love to hear your full and frank responses to this draft advice. What have we got wrong? What have we left out? What are other considerations or lessons you have learned? Thanks for any and all responses!To what extent can SharePoint do records management?

Wise Technology Solutions, an Australian consultancy group, has developed a very comprehensive report that assesses SharePoint 2010 against the International Council on Archives (ICA) Guidelines and Functional Requirements for Electronic Records Management Systems.

The ICA guidelines are very good and very comprehensive requirements statements that outline all the functionality that should be contained in a records management system. They are currently going through the final balloting process to become an international standard.

The Wise report is accessible via the Microsoft website. The report concludes that SharePoint is 88% compliant with the ICA requirements. The areas where full compliance could not be achieved relate to:

• ease of email capture
• native security classification and access control
• physical and hybrid records management

The report states that third party providers are able to offer products that plug SharePoint’s gaps in these areas.

It needs to be noted that in relation to the 88% compliance rating, the report very clearly makes the point that ‘we note that the achievement of these results is reliant on appropriate design and governance of implementation, configuration and set up to ensure consistency with desired records management outcomes’ [p6].

SharePoint will not apply good records management functionality out of the box. It has good capacities but they all need to be configured. We have heard quite consistently from many sources that SharePoint requires a lot of configuration but, provided the time, money and appropriate expertise can be allocated to this, the results can be very positive.

The full costs of the configuration do however need to be factored into the decision to implement SharePoint. SharePoint’s minimal licensing costs are appealing but it is important to quantify and budget for the necessary additional configuration costs that will be a part of the system implementation. As SharePoint generally operates as a series of team sites, costs should reflect the fact that each of these may have to be specifically configured to meet the particular recordkeeping requirements of each business area.

What will happen without good records management in SharePoint?

It’s important to realise that without the appropriate investment in configuration, your SharePoint implementation will likely become another sprawling, uncontrolled network or shared drive environment, with content existing everywhere. SharePoint’s native structure is much like a website, where it is possible to implement as many specific sites for different teams and projects or business areas as your organisation requires. Without strong records management frameworks, recordkeeping can quickly scale out of control in this kind of environment.

With appropriate strategy and development time, you will be able to establish good rules and infrastructures in SharePoint to help you manage all of this information, but time and money does need to be invested in developing and deploying good management functionality.

Recommendation: records managers must be involved with SharePoint implementations

Involving records managers at every step of the process to ensure that recordkeeping can support the business performed on team sites is critical to a successful SharePoint implementation.

Andrew Warland wrote an excellent article in iQ Magazine, August 2011, ‘What records managers need to know about SharePoint 2010’. In it he states that ‘One of the main reasons given by IT not to involve records managers in a SharePoint 2010 implementation is likely to be that “there are no records stored on the sites”. This is a bit like saying that there are no records stored in network shares or in Outlook folders.’

Corporate business is performed in SharePoint, therefore corporate records will be created and maintained in this business system.

SharePoint is regarded as a business system under the terms of the mandatory NSW government standard, Standard on digital recordkeeping. Records managers therefore need to be involved in its implementation to:

• ensure that SharePoint is deployed in ways which enable the organisation to create and maintain the records it needs to support its business operations, and
• ensure compliance requirements are met.

Retrospectively applying recordkeeping frameworks to systems like SharePoint is costly and challenging. It is much more effective to apply the right recordkeeping frameworks from the outset.

Start by knowing what your recordkeeping requirements are

Start the whole process of SharePoint implementation by knowing exactly what it is you need SharePoint to do.

Make sure you define your recordkeeping requirements and communicate these to your business and IT colleagues participating in the SharePoint implementation.

Recordkeeping requirements to consider include:

• what records need to be created to support your business operations?
• how long they need to be kept for?
• who needs to access them?
• what business processes do they need to be a part of?
• where are your areas of high risk and areas of low risk? (Prioritise the high risk and define key requirements here)
• what metadata needs to be applied to facilitate record use and management?

In SharePoint you need to choose the way you want recordkeeping to be managed

A criticism of SharePoint has been that it has no clear, single model for records management. Instead it has developed various different options and you need to specifically choose which options you want to deploy in your implementation.

This flexibility can be good, but it does mean you need to make specific decisions and choices about how you are going to manage your information. The choices you make will have implications through many aspects of your SharePoint implementation, so you must make a clear choice and then follow it through in the various different functionalities and in the team sites where you want to deploy the recordkeeping model selected.

The flexible model does of course mean that you can deploy different recordkeeping models in different business areas. You will however have to have good records of your different configuration decisions in this scenario and the sites where they have been deployed, and ensure you maintain all necessary components on all relevant sites.

The flexible SharePoint model also means that you need to have a good understanding of SharePoint 2010 and its available functionality from the start. Get to know the system, understand your options and then choose your preferred path.

UK records management consultant, James Lappin, has put together some excellent blog posts about implementation decisions concerning SharePoint. His post ‘Is there a sustainable and scaleable records management model in SharePoint 2010?’ outlines some of the issues to consider in relation to SharePoint’s flexible model. The comments following this post also contain some good implementation advice.

You need good recordkeeping tools to implement SharePoint effectively

If you have existing recordkeeping tools in place then your implementation decisions and configuration arrangements for SharePoint will be greatly simplified. If you have current versions of tools such as:

• disposal authorities
• metadata schema
• access and security classifications
• thesauri and business classification schemes
• workflow and business process assessments
• business rules that incorporate recordkeeping requirements

you will have some really useful and authoritative information on which you can start to build in some solid structures into your SharePoint implementation and significant automation of records management operations.

Given SharePoint is generally based around the use of specific team sites, it would be really beneficial if you had scalable versions of your recordkeeping tools that can be applied to a particular business unit or business process – ie have the ability to extract the specific parts of a disposal authority or BCS or metadata schema that apply to a particular business unit.

There is good capacity to automate recordkeeping activities

Once configured appropriately, SharePoint 2010 will enable the automation of a range of recordkeeping activities. This will simplify many processes and allow users to focus on their business operations.

For example, content types can be created in SharePoint and mapped to a retention and disposal authority or a ‘normal administrative practice’ type arrangement. Each content type can have its own specific metadata and retention information. This does mean that you need to make sure that the business rules and guidelines to staff on the use of content types are accurate, as a range of subsequent actions may depend on the content type classification. Retention rules in SharePoint can also be applied to libraries or folders.

SharePoint does good metadata

Andrew Warland in his iQ article calls SharePoint 2010 ‘a dream product for metadata lovers’. It enables records and business metadata to be applied to records, as well as metadata labels that users apply using their own terms.
Standard metadata can be applied to specific content types in SharePoint which helps to automate, standardise and facilitate metadata creation and management.

The good metadata functionality in SharePoint 2010 should, when configured, ensure it is able to meet the ‘point of capture’ and ‘process’ metadata requirements that are part of State Records’ mandatory Standard on digital recordkeeping.

There are ways of integrating SharePoint with common EDRMS products

Many EDRMS products do advertise integrations with SharePoint. This is one possibility for managing your business records created in SharePoint. However there are questions about many of the existing EDRMS/SharePoint integrations so ensure you fully road test EDRMS plug-ins before committing to them.

SharePoint cannot manage paper files

SharePoint 2010 is focussed on electronic records and is unable to manage paper and other physical format information or hybrid files effectively.

Remember, that SharePoint cannot fully manage email on its own

Despite SharePoint supporting email enabled lists and libraries, third party Outlook add-ons are still required to simplify user capture of email and required metadata.

So make sure you budget for these kind of third party tools in your SharePoint implementation. Even in collaborative workspaces such as that provided by SharePoint, email is still a fundamental business tool and so you will need to make arrangements to plan for its management.

SharePoint also needs help with security

Despite having item level security SharePoint 2010 is unable to impose classifications on information, or to control access effectively.

Again, third-party plug-ins have been developed to manage this so make sure to look at adopting these if you have security issues to resolve.

Bulk import and export may also be a challenge

SharePoint may not be able to manage all your bulk imports and bulk exports. This could be an issue for importing a range of current data into the system and could cause problems with digital longevity and sustainability in the future if you need to export a lot of data when changing systems.

Again, you may have to look at third-party providers to redress any identified gaps in these areas.

There will likely be an ongoing need to manage change

Because SharePoint will often be based on a team or project structure, its organisational framework can be subject to fairly regular change.

Therefore, if you use these structures to organise your implementation, ensure there are procedures in place to monitor and change recordkeeping rules whenever there is a organisational or project change in your organisation.

You will need to develop policies and procedures to support your users

SharePoint needs policy and procedural support like any other business system. Develop documentation to let staff know what their roles and responsibilities are in relating to the information they are creating and managing in SharePoint. Responsibilities should be outlined in position descriptions too, to ensure that the system continues to be managed well even through staff and organisational change.

Questions to ask when implementing SharePoint

• What are your business requirements?
• What role is SharePoint playing in your environment (in comparison to your EDRMS) and what do you foresee its future use will be?
• What areas of business will it cover?
• What are the areas of risk in these business areas?
• What records need to be created of these business areas?
• What rules need to be in place to protect these records?
• How long do these records need to be retained for?
• What are the most efficient ways in SharePoint to implement the recordkeeping rules that apply to this area of business?
• What will be the model for your SharePoint configuration? Will one standard model be applied or will different models for managing records be applied on different team sites? (Make sure that all models and configurations and adaptations are documented as these will be very important for managing system change through time.)
• What 3rd party plug-ins will you need to use and how will these be integrated? Do these need any configuration? (If so, document it.)
• What clear boundaries need to be applied between SharePoint and your corporate EDRMS so that there is not duplication between the systems or confusion for the users?

What else?

Please feel free to provide us with any further or alternative SharePoint information to help us develop the next version of this advice. Thanks!